windows - Get the callstack(s) when a kernel32.dll function is called -

I have a procedure that changes its current directory, and I have to know when and where it would be is. How can I go about doing this?

I tried to set a breakpipe with Visual Studio SetCurrentDirectoryA / SetCurrentDirectoryW, but it does not work.

Are you debugging one of your programs, or you do not have a source code for one ? Visual Studio Debugger is not very friendly in relation to debugging non-source applications; In that case, I would recommend it - or even using skipping the debugger and writing a mechanical logger.

Edit:

{, Try setting a breakpoint on kernel32. Dll} _SetCurrentDirectoryA @ 4 - Strange syntax and decorated names are required. I have not tried it myself, but found it. Google keyword: " Visual Studio Breakpoint API "):